Putting Cloudflare in front of a cPanel-hosted site is one of those changes that pays off immediately — faster page loads for visitors far from your server, a free layer of DDoS protection, and one dashboard for cache and SSL settings. It's also one of the easiest things to get wrong. Get the DNS import wrong and mail stops arriving. Get the SSL mode wrong and you land in a redirect loop. Here's how to do it properly the first time, using a real SkyServer cPanel account as the example.
Why Bother With Cloudflare on Shared or VPS Hosting?
Your SkyServer server already serves pages fast from its own data center. What Cloudflare adds is a network of edge locations in front of it. Static assets — images, CSS, JS — get cached close to the visitor instead of round-tripping to your origin every time. You also get a free WAF-lite (basic firewall rules), rate limiting on the free plan, and Cloudflare absorbs traffic spikes and most attack traffic before it ever touches your cPanel account's bandwidth allowance.
None of that is automatic, though. Cloudflare only helps the requests you actually route through it, and a sloppy setup can quietly break email or push visitors into an infinite redirect.
Before You Start: Gather This First
- Access to your domain's registrar (to change nameservers, or to add records if you're using the CNAME setup method instead).
- cPanel login, so you can check your current DNS zone under Zone Editor before you migrate anything.
- A list of subdomains that matter —
mail.,webmail.,cpanel.,autodiscover., any staging or API subdomains. - Ten minutes where you can watch mail flow and site availability closely after the cutover.
In WHM/cPanel, pull up your current zone with: Zone Editor → yourdomain.com → Manage, or from SSH: dig yourdomain.com ANY +short and dig MX yourdomain.com +short. Screenshot or copy this somewhere before you touch anything.
Step 1: Add the Site to Cloudflare
Sign up (or log in) at Cloudflare, click Add a Site, and enter your domain. Pick the Free plan if you're just after CDN + basic SSL + caching — it's enough for the vast majority of cPanel-hosted WordPress and static sites. Cloudflare will scan your existing DNS records automatically and show you a list before you commit to anything.
Step 2: Point the Domain at Cloudflare
You have two options here, and which one you pick matters:
| Method | How it works | When to use it |
|---|---|---|
| Change nameservers | You update the domain's NS records at the registrar to Cloudflare's two assigned nameservers (e.g. ana.ns.cloudflare.com) | Standard approach — Cloudflare fully manages your DNS zone |
| CNAME setup | Keep SkyServer's nameservers, add a CNAME per record pointing into Cloudflare | Enterprise-plan only in most cases; rarely worth it for cPanel hosting |
For nearly everyone reading this, changing nameservers is the right call. Log in to your domain registrar, replace the existing nameservers (SkyServer's or your registrar's default ones) with the two Cloudflare gives you, and save. This step is what actually routes traffic through Cloudflare — nothing works until it propagates.
Nameserver changes typically propagate within a few hours, though it can take up to 24-48 hours in stubborn cases. Cloudflare emails you once it detects the change and activates the zone.
Step 3: Check Every Imported DNS Record Before You Go Live
This is the step people skip, and it's the one that breaks email. Cloudflare's auto-scan is good but not perfect — it can miss TXT records, get proxy status wrong, or drop a record with an unusual TTL. Before the nameserver change finishes propagating, go through the imported zone line by line against what you copied from cPanel's Zone Editor in the prep step.
Pay special attention to:
- MX records — must be present, correct priority, and DNS only (grey cloud, never orange). Cloudflare doesn't proxy mail traffic; a proxied MX record simply won't work.
- SPF, DKIM, DMARC TXT records — these often get missed on import since they're just text records with no obvious "this matters" flag. Missing SPF/DKIM after a nameserver switch is the single most common cause of mail suddenly landing in spam or bouncing.
- The main A record for your domain, pointing at your SkyServer server IP — this one you generally do want proxied (orange cloud) to get CDN and SSL benefits.
mail.,webmail.,cpanel.,whm.,autodiscover.subdomains — keep these grey-cloud (DNS only). Proxying webmail or cPanel login through Cloudflare causes certificate mismatches since those services use SkyServer's own SSL cert, not Cloudflare's.
Orange cloud = proxied through Cloudflare (gets CDN + WAF + hides your origin IP). Grey cloud = DNS only, resolves straight to your server. As a rule: your main website and www get proxied; anything mail- or panel-related stays grey.
Step 4: Choose the Right SSL/TLS Mode
This is where most redirect-loop tickets come from. Cloudflare's SSL/TLS tab has four modes, and picking the wrong one either breaks HTTPS or creates an infinite redirect between Cloudflare and your origin.
| Mode | What it does | Verdict |
|---|---|---|
| Off | No HTTPS at all through Cloudflare | Don't use it |
| Flexible | Visitor ↔ Cloudflare is HTTPS, but Cloudflare ↔ your origin is plain HTTP | Avoid — if your cPanel site force-redirects HTTP to HTTPS (most WordPress sites do via .htaccess or Really Simple SSL), this loops forever |
| Full | Encrypts both hops, but doesn't validate your origin's SSL certificate | Works, but accepts self-signed or expired certs silently |
| Full (strict) | Encrypts both hops AND validates your origin certificate is real and unexpired | Recommended — use this if AutoSSL is active on your SkyServer account |
Since cPanel hosting with AutoSSL gives every domain a valid Let's Encrypt certificate by default, Full (strict) is almost always the correct choice. Set it under SSL/TLS → Overview. Give it a few minutes to apply, then load your site in a private/incognito window to confirm there's no redirect loop and the padlock shows a valid certificate.
Also turn on Always Use HTTPS (SSL/TLS → Edge Certificates) so Cloudflare itself handles the HTTP→HTTPS redirect at the edge, rather than leaving it to a WordPress plugin or .htaccess rule that might conflict with it.
Step 5: Set Caching That Won't Break wp-admin or Checkout
Cloudflare's default caching behavior on the Free plan mostly respects your origin's cache headers for HTML, which is usually safe. Where people get burned is aggressive "cache everything" page rules applied domain-wide, which start serving stale versions of wp-admin, the cart, or checkout pages to different visitors.
Go to Rules → Page Rules (or Cache Rules on newer dashboards) and add:
yourdomain.com/wp-admin/*→ Cache Level: Bypassyourdomain.com/wp-login.php→ Cache Level: Bypass- For WooCommerce:
yourdomain.com/cart/*,/checkout/*, and/my-account/*→ Cache Level: Bypass
If you're running a caching plugin like LiteSpeed Cache or WP Super Cache on the cPanel side already, that's fine — the two layers work together rather than against each other, as long as wp-admin and dynamic pages are excluded from both.
Step 6: Verify Before You Walk Away
- Send a test email to and from the domain — confirm mail still delivers both ways.
- Load the site in an incognito window and check for redirect loops or certificate warnings.
- Run
dig yourdomain.com +shortand confirm it resolves to a Cloudflare IP, not your server's IP directly (that's expected once proxied). - Check SSL/TLS → Edge Certificates shows an active Universal SSL certificate for the domain.
Prevention: Keep It From Breaking Later
Cloudflare setups tend to break weeks later, not on day one — usually because someone adds a new subdomain in cPanel's Zone Editor and forgets it now needs to be added in Cloudflare too, since Cloudflare is the authoritative DNS once nameservers point there. From this point forward, treat Cloudflare's dashboard as your zone editor, not cPanel's. Any new subdomain, MX change, or TXT record needs to go in Cloudflare directly; changes made only in cPanel's Zone Editor are invisible to the outside world once nameservers have moved.
Frequently Asked Questions
Do I still need AutoSSL in cPanel if I'm using Cloudflare's SSL?
Yes, if you're using Full or Full (strict) mode — which you should be. Cloudflare encrypts the visitor-to-Cloudflare hop with its own certificate, but the Cloudflare-to-origin hop still needs a valid certificate on your SkyServer account. AutoSSL handles that automatically and renews it, so just leave it running.
Will switching to Cloudflare break my existing email?
Only if the MX, SPF, DKIM, or DMARC records get lost or misconfigured during the DNS import, or if someone accidentally proxies an MX record (which doesn't work at all). Double-check those records against your original cPanel zone before and after the nameserver switch, and keep mail-related records set to DNS only.
Why does my site show a redirect loop right after enabling Cloudflare?
This is almost always the SSL/TLS mode set to Flexible while your origin server also force-redirects HTTP to HTTPS. Switch the mode to Full or Full (strict) under SSL/TLS → Overview and the loop should resolve within a minute or two.
Should I proxy (orange cloud) my mail and cPanel subdomains?
No. Keep mail., webmail., cpanel., whm., and autodiscover. set to DNS only (grey cloud). These services use SkyServer's own SSL certificates and don't benefit from proxying — proxying them typically causes certificate errors or broken connections in mail clients.
Can I move back to cPanel-only DNS later if I want to drop Cloudflare?
Yes. Export your current zone from Cloudflare's DNS tab, recreate any records that changed in cPanel's Zone Editor, then change the nameservers back to SkyServer's at your registrar. Keep both zones in sync during the transition window until propagation completes, the same way you did on the way in.
